VeraxConsole

Remediation Plan

Ready-to-run fixes, worst risk first. Verax generates the config; your stack executes it.

criticalBlock Perplexity AI at the firewallFortiGate · addresses 28 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-Perplexity-AI"
        config entries
            edit 1
                set url "perplexity.ai"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

criticalBlock OpenAI ChatGPT at the firewallFortiGate · addresses 27 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-OpenAI-ChatGPT"
        config entries
            edit 1
                set url "chatgpt.com"
                set type simple
                set action block
            next
            edit 2
                set url "openai.com"
                set type simple
                set action block
            next
            edit 3
                set url "chat.openai.com"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

criticalBlock GitHub Copilot at the firewallFortiGate · addresses 23 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-GitHub-Copilot"
        config entries
            edit 1
                set url "copilot.github.com"
                set type simple
                set action block
            next
            edit 2
                set url "api.githubcopilot.com"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

criticalBlock Google Gemini at the firewallFortiGate · addresses 23 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-Google-Gemini"
        config entries
            edit 1
                set url "gemini.google.com"
                set type simple
                set action block
            next
            edit 2
                set url "bard.google.com"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

criticalBlock Grammarly at the firewallFortiGate · addresses 23 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-Grammarly"
        config entries
            edit 1
                set url "grammarly.com"
                set type simple
                set action block
            next
            edit 2
                set url "app.grammarly.com"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

criticalBlock Microsoft Copilot at the firewallFortiGate · addresses 18 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-Microsoft-Copilot"
        config entries
            edit 1
                set url "copilot.microsoft.com"
                set type simple
                set action block
            next
            edit 2
                set url "copilot.cloud.microsoft"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

criticalRevoke OAuth grant to ChatGPTMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp0-1"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0001 --set accountEnabled=false

criticalRevoke OAuth grant to ChatGPTMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp0-3"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0001 --set accountEnabled=false

criticalRevoke OAuth grant to GeminiMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp2-4"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0003 --set accountEnabled=false

criticalRevoke OAuth grant to GeminiMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp2-0"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0003 --set accountEnabled=false

criticalRevoke OAuth grant to Fireflies.ai NotetakerMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp3-all"

Revokes the tenant-wide admin consent for this app. To disable the app entirely: az ad sp update --id app-0004 --set accountEnabled=false

criticalRevoke OAuth grant to Otter.aiMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp4-1"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0005 --set accountEnabled=false

criticalRevoke OAuth grant to Otter.aiMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp4-0"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0005 --set accountEnabled=false

criticalRevoke OAuth grant to Otter.aiMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp4-4"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0005 --set accountEnabled=false

mediumBlock Slack AI at the firewallFortiGate · addresses 92 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-Slack-AI"
        config entries
            edit 1
                set url "slack.com"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

mediumRevoke OAuth grant to PerplexityMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp5-3"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0006 --set accountEnabled=false

mediumRevoke OAuth grant to PerplexityMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp5-0"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0006 --set accountEnabled=false

lowBlock Anthropic Claude at the firewallFortiGate · addresses 21 findings
config webfilter urlfilter
    edit 0
        set name "Verax-Block-Anthropic-Claude"
        config entries
            edit 1
                set url "claude.ai"
                set type simple
                set action block
            next
            edit 2
                set url "anthropic.com"
                set type simple
                set action block
            next
        end
    next
end

Attach this urlfilter to a webfilter profile applied to your outbound policy.

lowRevoke OAuth grant to ClaudeMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp1-0"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0002 --set accountEnabled=false

lowRevoke OAuth grant to ClaudeMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp1-5"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0002 --set accountEnabled=false

lowRevoke OAuth grant to ClaudeMicrosoft Graph · addresses 1 finding
az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/grant-sp1-4"

Revokes the user consent for this app. To disable the app entirely: az ad sp update --id app-0002 --set accountEnabled=false